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[57] ABSTRACT 

A single breakpoint address register on a CPU is shared to 
emulate a plurality of breakpoint registers, A plurality of 
breakpoints are stored in an emulation area of main memory. 
One of these breakpoints is loaded into the single breakpoint 
register on the CPU. When a translation-lookaside buffer 
(TLB) on the CPU detects a page miss, a page miss handler 
activates a debug processing routine to determine if the 
faulting page contains one of the breakpoints. If the faulting 
page does contain a breakpoint, then this breakpoint is 
written to the single breakpoint register on the CPU. Any 
page in TLB Is invalidated if it contained the old breakpoint 
that was overwritten by the new breakpoint in the single 
breakpoint register. Thus only one breakpoint can have a 
page translation in the TLB at any time, and the breakpoints 
are swapped in and out of single breakpoint register when 
the TLB entries are swapped. A TLB invalidate entry 
instruction finds the old breakpoint's TLB entry and invali- 
dates it When multiple breakpoints exist on a single page, 
then that page is divided into partial pages, with each partial 
page having just one breakpoint The TLB entries contain 
upper and lower bounds fields to identify the extent of the 
partial page. A bit in the condition register is set when 
multiple breakpoints exist on the same page. 

18 Claims, 14 Drawing Sheets 
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METHOD FOR EMULATING MULTIPLE 
DEBUG BREAKPOINTS BY PAGE 
PARTITIONING USING A SINGLE 
BREAKPOINT REGISTER 

BACKGROUND OF THE INVENTION — 
RELATED APPLICATIONS 

This application is a continuation-in-part (QF) of "Emu- 
lation of Segment Bounds Checking Using Paging with 
Sub-Page Validity", U.S. Pat No. 5,440,710, U.S. Ser. No. 
08/207,857 filed Mar. 8, 1994, assigned to the same 
Assignee and with at least one common inventor. This 
application is also related to "Emulation of Program Watch- 
point Checking Using Paging With Sub-Page Validity", U.S.. 
Ser. No. 08/444,813, assigned to the same Assignee and with 
at least one common inventor. This application is further 
related to "A Translator having Segment Bounds Encoding 
For Storage in a TLB", U.S. Ser. No. 08/436,137 , also 
assigned to the same Assignee and with at least one common 
inventor 

BACKGROUND OF THE INVENTION — FIELD 
OF THE INVENTION 

This invention relates to computer systems, and more 
particularly to emulation of breakpoint checking. 

BACKGROUND OF THE INVENTION-, 
DESCRIPTION OF THE RELATED ART 

Advanced architectures such as RISC (reduced instruc- 
tion set computers) provide fewer computing resources in 
hardware than older CISC (complex instruction set 
computer) architectures. While RISC has the potential of 
higher operating speeds than CISC, many programs have 
been written for CISC architectures. Most personal comput- 
ers (PCs) use the x86 architecture, at present embodied in 
CPU's such as the 386, 486, and Pentium™ manufactured 
by Intel Corporation of Santa Clara, Calif., and others. 

The parent application discloses a RISC architecture 
capable of emulating certain aspects of the x86 CISC 
architecture. In particular, segmentation is emulated by 
extending the translation-lookaside buffer (TLB) to allow 
for less than a whole page to be valid. 

Like the x86 segmentation, x86-style program watchpoint 
or breakpoint checking is awkward to implement in a 
standard RISC processor. RISC processors such as Pow- 
erPC™ processors by Motorola provide far fewer hardware 
resources than x86 processors. While additional breakpoint 
registers, comparators, and control logic could be added to 
a RISC processor to support CISC breakpointing, this 
increases the cost and complexity of the RISC processor. 

PRIOR-ART CISC DEBUG HARDWARE — FIG, 1 

FIG. 1 is a block diagram of debug breakpoint hardware 
in a typical x86 processor, which includes paging. 

Linear address 18 is translated to physical address 20 by 
translation-lookaside buffer or TLB 16, which is a small 
cache of the page translation tables stored in main memory. 
TLB 16 translates the upper 20 bits of linear address 18 by 
searching the associative TLB cache for a match, and if one 
is found, then replacing these upper 20 bits with another 20 
bits stored in the TLB 16. 

If the linear address is not found in the TLB, then a miss 
is signaled to a translator (not shown), which accesses the 
page tables in main memory and loads into the TLB the page 
table entry that corresponds to the linear address. Future 
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references to the same page will "hit" in the TLB, which will 
provide the translation. 

Four debug registers 10 may each contain a linear address 
where a breakpoint is to occur. When a program accesses an 

5 instruction or data operand at this linear address, then a 
breakpoint is signaled and the program halted. Comparators 
26 compare the current linear address 18 to the breakpoint 
addresses stored in debug registers 10 and output match 
indications to AND gates 12. 

10 Debug control register 14 contains bits to enable each of 
the four debug registers 10, and possibly a global debug 
enable bit. Register 14 also contains data/code bits to 
indicate if the breakpoint addresses in each of debug regis- 
ters 10 are for instruction addresses or data operand 

15 addresses. Four bits may be used, one for each debug 
register 10. Thus some breakpoints may be for instructions 
while others for data. These data/code bits in register 14 are 
compared to a data/code signal 21 which indicates if the 
current linear address 18 is for a data operand or an 

20 instruction (code). Comparators 28 compare the D/C signal 
21 to each of the four data/code bits in register 14, and 
output D/C match signals 24 to AND gates 12. If linear 
address 18 matches one of the breakpoint addresses in 
registers 10, and the data/code signal 21 matches the data/ 

23 code bit in register 14, then one of AND gates 12 will output 
a high signal which will be passed by OR gate 22 to generate 
a breakpoint signal. Comparators 28 may also check that the 
debug registers 10 are enabled before generating the match 
indication. 

30 

OBJECTS OF THE INVENTION 

While the prior-art debug apparatus is effective, RISC 
processors may provide only one or two debug registers and 

35 comparators, rather than the four used by x86 CISC CPU's. 
The RISC debug registers are restricted to either instruction 
or data operands and are thus less flexible than the CISC 
debug registers. In the PowerPC™ architecture, a single 
register is provided for data operand breakpointing, while 

^ another single register is provided for instruction break- 
pointing. 

What is desired is to emulate multiple breakpoints with a 
single breakpoint register. When multiple breakpoints are 
enabled, it is desired to emulate CISC-style breakpointing 
45 with a simple RISC-type paging system that allows for 
partial pages or sub-page validity. Emulation routines are 
desired to properly handle a page miss when the page 
contains a breakpoint Emulation routines are also desired to 
emulate setup of debug registers. 

50 SUMMARY OF THE INVENTION 

In one aspect the invention is a method for emulating a 
plurality of breakpoints on a processor with a single break- 
point register which stores just one breakpoint address. The 

53 processor also has a translation-lookaside buffer (TLB) with 
a plurality of page entries. The breakpoints are addresses 
which halt execution of a user program when accessed. 

Page entries are freely loaded into the TLB when no more 
than one breakpoint in the plurality of breakpoints is 

60 enabled. When two or more breakpoints in the plurality of 
breakpoints are enabled, then a page fault is signaled when 
a faulting page does not have a translation in the TLB. It is 
determined if a breakpoint in the plurality of breakpoints 
falls within the faulting page when the page fault is signaled. 

65 The breakpoint falling within the faulting page is hereinafter 
referred to as a first breakpoint A page entry is loaded into 
the TLB for the faulting page while the first breakpoint is 
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loaded into the breakpoint register on the processor when the 
faulting page contains the first breakpoint. Any page entries 
in the TLB containing a breakpoint are invalidated other 
than the faulting page entry. Execution of the user program 
is halted when the user program accesses an address match- 
ing the breakpoint address in the breakpoint register on the 
processor. 

Thus only one breakpoint in the plurality of breakpoints 
has a page translation entry in the TLB, which is loaded into 
the breakpoint register on the processor when the faulting 
page entry is loaded into the TLB. 

In other aspects of the invention the plurality of break- 
points are addresses of data operands or instructions. Further 
aspects include a step to determine when more than one 
brealqpoint in the plurality of breakpoints falls within the 
faulting page. The faulting page is divided into partial pages 
when more than one breakpoint falls within the faulting 
page. Each partial page contains no more than one break- 
point in the plurality of breakpoints. Bounds fields are 
loaded into the TLB when loading the page entry for the 
faulting page when the faulting page contains more than one 
breakpoint. The bounds fields define the boundaries of the 
partial page within the faulting page. Thus pages may 
contain multiple breakpoints yet the multiple breakpoints 
share the single breakpoint register on the processor. 

In other aspects a multiple-breakpoint bit in a condition 
register on the processor is read to determine when multiple 
breakpoints are enabled The multiple-breakpoint bit is set 
when a second breakpoint is enabled in the plurality of 
breakpoints and the second breakpoint falls within a page 
which already contains another enabled breakpoint in the 
plurality of breakpoints. 

Other aspects of the invention include a system for 
emulating processing of a plurality of breakpoints. The 
breakpoints are addresses which halt execution of a user 
program when accessed. A central processing unit (CPU) 
has a breakpoint register that stores a single breakpoint 
address which halts execution of a user program when 
encountered An address compare means receives a linear 
address generated by execution of the user program and is 
coupled to the brealqpoint register. It compares the linear 
address to the breakpoint address and signals a breakpoint 
fault when an address match occurs. A translation-lookaside 
buffer (TLB) receives the linear address. The TLB has a 
plurality of page translation entries for pages in memory 
having a fixed number of offset addresses. Each page 
translation entry has a linear address field and a physical 
address field. The TLB outputs the physical address field for 
a matching entry when a portion of the linear address 
matches the linear address field in the matching entry. A 
memory has a plurality of storage locations addressable by 
a plurality of physical addresses. A first portion of the 
memory stores a debug table which has a plurality of debug 
entries each for storing a breakpoint address. A second 
portion of the memory stores an emulation handler routine 
which includes a means for copying a breakpoint address 
from one of the debug entries in die debug table to the 
breakpoint register on the CPU. An invalidation means 
invalidates a translation entry in the TLB containing a 
breakpoint address stored in the debug table but not stored 
in the breakpoint register on the CPU. 

Thus only one breakpoint from the debug table in memory 
has a page translation entry in the TLB. The one breakpoint 
is loaded into the breakpoint register on the processor by the 
emulation handler routine. 

In other aspects the CPU has a bound field in the matching 
entry in the TLB. The bound field contains a bound for a 



4 

partial page. A bounds checking means receives the bound 
from the matching entry of the TLB and compares a portion 
of the linear address to the bound A page fault is signaled 
if the linear address is outside the bound for the partial page. 
5 The emulation handler means has a partial page loading 
means for loading the bound field of the matching entry 
when the page translation entry is for a page containing 
multiple breakpoints. The page is divided into partial pages 
each containing one brealqpoint 
10 Another aspect of the invention is a method for emulating 
a plurality of breakpoints on a processor with no breakpoint 
register. A translation-lookaside buffer (TLB) on the proces- 
sor has a plurality of page entries. Pages entries are freely 
loaded into the TLB when no breakpoint in the plurality of 
15 breakpoints is enabled When one or more breakpoints in the 
plurality of breakpoints are enabled then a page fault is 
signaled when a faulting page does not have a translation in 
the TLB. If a brealqpoint in the plurality of breakpoints falls 
within the faulting page when the page fault is signaled, then 
20 no page entry is loaded into the TLB for the faulting page. 
A memory access is instead emulated for the faulting page 
when the faulting page contains the breakpoint Execution of 
the user program is halted when the user program accesses 
an address matching the breakpoint address. Thus no break- 
25 point in the plurality of brealopoints has a page translation 
entry in the TLB. 

BRIEF DESCRIPTION OF THE DRAWINGS 

30 FIG. 1 is a block diagram of debug breakpoint hardware 
in a typical x86 processor, which includes paging. 

FIG. 2 is the breakpoint apparatus for a RISC processor. 

FIG. 3 shows in detail an embodiment for a TLB with 
sub-page validity. 

35 FIG. 4 is a diagram of a physical memory space which 
contains a user program, an operating system, and emulation 
handler routines. 

FIG. 5 is a debug processing routine executed when a 
page misses in the TLB. 

40 

FIG. 6 is a diagram of the condition register CR on a RISC 
processor with bits defined for aiding debug emulation. 

FIG. 7 is a state diagram of the debug setup sequence as 
debug register setup instructions are emulated 
45 FIG. 8 shows the storage structures in emulation memory 
that are maintained by a debug load routine and a TLB miss 
routine with debug processing. 

FIG. 9 is a routine that emulates a debug register load 
instruction. 

50 FIG. 10 shows partitioning of a page which contains three 
breakpoints into partial pages. 

FIGS. UA t 11B show an example of how the storage 
structures in the debug setup area of the emulation memory 
55 are modified as debug registers are loaded and enabled. 

FIGS. 12A* 12B, 12C show an example of how the TLB 
and RISC breakpoint register DABR are modified as page 
misses and hits occur. 

^ DETAILED DESCRIPTION 

The present invention relates to an improvement in pro- 
gram debugging using breakpoints. The following descrip- 
tion is presented to enable one of ordinary skill in the art to 
make and use the invention as provided in the context of a 
65 particular application and its requirements. Various modifi- 
cations to the preferred embodiment will be apparent to 
those with skill in the art and the general principles defined 
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herein may be applied to other embodiments. Therefore, the memory, or by a cache of the page table such as a 
present invention is not intended to be limited to the par- translation-lookaside buffer (TLB). The physical address is 
ticular embodiments shown and described, but is to be thus composed of the translated page number and the 
accorded the widest scope consistent with the principles and un-translated offset. Page tables and TLB's are well-known 
novel features herein disclosed s and are discussed more fully with respect to the x86 archi- 
tecture in U.S. Pat No. 4,972,338, issued in 1990 to Craw- 
RISC BREAKPOINT HARDWARE — FIG. 2 ford and assigned to Intel Corporation of Santa Clara, Calif. 
_rn a * ,« * , . . ^ r. nTPP A TLB is a small cache of the most recently used translations 
FIG. 2 is the breakpoint apparatus for a RISC processor. . m inasmuch as the n affe tables are usually 
Virtual address 18 can be the x86 linear address when the in ™ ™ ? age . ^asmucft as the page tables are usiially 
, . ..... . , . , . , . 10 stored in main memory, accessing the page table for each 

H£L i'by SlaSS^ide £h£** SfS "V* sl ° WS «^ *"»■ Sin " ** 

well-knownii theart Condition register 32 contaiisflags or ****** ""i 1 ^ «»« « b f ^ y ^ 

_ . * , ^ . ^ , * page table entries need to be cached by the TLB for a high 

condition codes that are^rt by programsand the operating w performance for most programs, 

system. In the PowerPC™ RISC architecture, register 32 is ; T 

known as the CR register. Data-address breakpoint register term ™toal address is often used rather loosely to 

(DABR) 30 is loaded with a breakpoint address for a data refer t0 a^ress except the physical address. The physi- 

operand, while instruction-address breakpoint register ^ address is output from the paging unit and is the actual 

(IABR) 34 is loaded with a virtual address where a break- address in memory of a datum. When both segmentation and 

point of an instruction is to occur. 20 paging are combined, a user program generates an "effective 

« , M A . i jj« address", which is then translated by the segmentation unit 

Comparators 36, 38 compare the current virtual address . t<1 . ' . , „ ™ ,/ , ~__ , * , . 

18 to the data and instructioTbreakpoint addresses storedin ° a • ^ actress is then translatedby 

registers 30, 34 and generate datobreakpoint signal 35 or * e P T g ^ * ?Z »y«CBl addiw . Some- 

zZZ^ J i * f \- , <^7 ft times the effective address and the linear address are referred 

instruction breakpoint signal 33 if an address match occurs. ^ ^ ag addresses 

A breakpoint control register (not shown) may also be used 

to mask off some of the bits compared, allowing for the TLB SUB-PAGE FIELDS FOR BOUNDS 

breakpoint to occur over a range of addresses. COMPARE LOGIC— FIG. 3 

• l K i Pr ° V !, deS °SL^ eak ?? in !K r t e8iSter , f u r FIG. 3 shows in detail an embodiment for a TLB with 
^^mi^bx^mU^^o^ 30 rob ^ vaM fr. Tte ^mm,* mc 32-bit linear and 

used for data operands. The present invention includes . Kr. J J a * * ^A *o ^ 

A . r\ 1* * physical addresses are stored in fields 66, 68, as in prior-art 

methods to use either one of these registers to emulate up to fL-L, A „ .. _ . , . ^» . V . \ _ A *; 

* i u i * • ♦ V *u ,n , u .. TLB s, Attributes are stored m attributes field 70. Two page 

x86-style breakpoint registers. Since these are 32-bit ^ bounds ^ M ^ ^ 

breakpoint registers, significant hardware is saved. ^ page offget rf ^ ^ ^ ^ portion rf ^ 

TLB WITH SUB-PAGE FIELDS 35 page * partially-valid pages. Two control fields 86, 88 

BACKGROUND enable page offset bounds fields 82, 84, respectively. Each 

control field 86, 88 is one bit When the control bit is high, 

Several embodiments of a RISC-type paging system comparison of the corresponding offset bounds field to the 

adapted for emulation of segment bounds checking are offset of the current linear address is enabled, 

presented in the parent, U.S. Pat No. 5,440,710. ATLB was 40 Two page offset bounds fields are provided in this 

disclosed which is capable of having less than a full page embodiment for efficient encoding of pages with two events, 

valid. While the predominant use of sub-page validity is for which occur for small segments that lie entirely within a 

emulation of segmentation, sub-page validity may also be single page, program breakpoints, and faulty memory loca- 

used for emulation of breaipointing. When combined with tions. These are typically small blocks within a page. Thus 

RISC's single breakpoint registers, sub-page validity can 45 by having two page offset bounds fields, the starting and 

emulate a larger set of breakpoint registers. However, efli- ending addresses for the small block may be specified. This 

cient procedures to implement the emulation of breakpoint- is especially useful when multiple breakpoints occur within 

ing are desired. Novel emulation routines and data structures one page, as will be described in detail later, 

have been invented for use with a CPU having a RISC-type 5o m page offset bounds fields ^ $4 contain en ough bits 

paging system. t0 specify the page offset down to the desired granularity. 

In a paging system, a page table defines the mapping or Thus for a 4K-byte page, which has 12 bits of address offset, 

translation between a program or virtual address generated 32-bit aligned word granularity requires that 10 bits be 

by the user's program, and a physical address of a location stored in each page offset bounds field 82, 84, while full 

in memory. Physical memory is divided into many pages, 55 byte-granularity requires that a full 12-bit offset address be 

with each page being the same size, typically 4096 or 4K stored in each page offset bounds field 82, 84. 

bytes. Each page begins and ends on a "page boundary", Sub-page logic 100 includes comparison logic 90 which 

which is always a multiple of the page size, 4K bytes. outputs a one to AND gate 94 when the 12-bit offset portion 

TA__x_TTr\xre of the current linear address is less than the 12-bit offset 

DEFINITIONS ^ gtored m field 8Z ff ^ ^ bit m 

A virtual address is composed of two parts: the lower 12 control field 86 is also enabled (high), then an error will be 

bits form the address within a page, or page offset, while the signaled on bounds error line 99 from OR gate 98. Thus the 

upper address bits determine which page is accessed. The first comparison signals an error when the linear address is 

upper bits of the virtual address are the virtual page number, below the first offset bounds. 

and these upper bits are translated and replaced with a 65 The opposite type of comparison is performed far the 

physical page number. The virtual page number is translated second offset bounds field. Comparison logic 92 outputs a 

to a physical page number by either a page table in main one to AND gate 96 when the 12-bit offset portion of the 
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current linear address is greater than the 12-bit offset bound only one RISC breakpoint register, only one breakpoint can 
stored in field 84. If the second control bit stored in control be loaded into this RISC register. The other breakpoint 
field 88 is also enabled (high), then an error will be signaled addresses are stored in emulation memory. These other 
on bounds error line 99 from OR gate 98. The second breakpoints are prevented from triggering by removing their 
comparison thus signals an error when the linear address is 5 page entry from the TLB. Only the single 'active' breakpoint 
below the first offset bounds. in the RISC breakpoint register may have its page entry in 

IWe 1 shows the encoding of control bits 86, 88 and how the the otner brealqpoints are 'disabled' by not having 
the 12-bit offset of the linear address is compared to the a valid entr y m ^ Fc * these 'disabled' breakpoints to 
offset bounds fields. Indole 1, *y* refers to the value stored trigger, their page entry must first be loaded into the TLB 
in first offset bounds field 82, while "z" refers to the value 10 and me breakpoint register overwritten with the 'dis- 
stored in second offset bounds field 84. Proper programming abled* breakpoint from emulation memory. The breakpoint 
of these offset bounds fields and their control bits allows for that was 'active' in the RISC breakpoint register must have 
checking the lower bound of the valid block, or checking the its TLB entry invalidated. A debug processing routine is 
upper bound of the block. Comparison for both fields may added t0 the page fault routine to shuffle the breakpoints 
be enabled to allow for checking of very small blocks that 15 between the single RISC breakpoint register and emulation 
lie entirely within a single page. memory. 

Case (3) is by far the most complex. Multiple breakpoints 
TABLE 1 exist on a single page. The method for case (2) of swapping 

pages will not work when two breakpoints are on the same 
20 page. 

The TLB allows a page entry to specify that only a portion 

of a page is valid instead of the entire 4 Kbytes. The page 

with multiple breakpoints is divided into non-overlapping 

sub-pages or portions, each portion containing a single 

25 breakpoint Only one of the portions is loaded into the TLB 

at any time; the breakpoint in this loaded portion is •active' 

c _ , . - . . i v . and copied into the single RISC breakpoint register. The 

fJSE?^ other breakpoints are left in emulatioTmemory and -dls- 

£ « abled* by not having their portion(s) loaded into the TLB. 

88setto W . Aeentirepageisyalid An encoding of 10 30 0therwise , me me £ od ^ ^ (2) is used Qr be 

specifies that all addresses greater than the second offset i. j ^ /^i A j t. * , , 

uL» n A ha „ « , u ♦ Z i . . combined with case (3)'s method when multiple breatoomts 

bound 84 are valid, as when a segment or block begins j ^ . , r . 

•i* • rL < mw ^ " " ; Ju^Z occur on oae P a S e < and other breakpoints occur on other 

within a page. The "01" encoding may be used for the end r ° ^ 

of a segment or block, when the upper bound ends within a " 

page. Thus the first offset bound 82 specifies the upper limit 35 SOFTWARE HANDLER ROUTINE 

of validity within the page. Encoding "11" specifies validity 

between the two offset bounds 82, 84, which may be used to These methods for cases (1), (2), and (3) are contained in 
specify a segment or block that lies entirely within a single two software routines shown in FIG. 4: 
P a g c - I. A debug processing routine in the TLB page miss 

OVERVIEW OF INVENTION 40 handler or routine 30D. 

2. A debug load or setup routine 200 that emulates x86 
A typical RISC CPU, as shown in FIG. 2, contains only instructions that alter the contents of the debug registers. 

Z^Tu^J*** ^^X'S^t 0D °, f0r HG. 4 is a diagram of a physical memory space 78 which 
^micuon breakpoints^ Four OSC breakpoint registers comalns a user £ ^ operating system 112. and 

of the single RISC brealqpoint registers and the TLB. A m mdude several routines actiyated for ^ reasonSt 

S™f f ^^^^ ™ ese routi * es " dudc 713 page miss routine 300 and 

modified TLB of FIG. 3 is used for case (3), when two or ^ load routine 20 o, detailed in FIGS. 5, 10. 

more breakpoints fall within a page. Pagc taWcs m rcsidc ncar operatillg systcm U2 . while 

Three cases or possible configurations of the x86 OSC 50 de bug register setup memory area 135 resides near emula- 

breakpoint registers are possible: tion handler routines 117. 

(1) Only one of the four x86 CISC breakpoint registers is 

enabled. DEBUG PROCESSING FOR TLB PAGE MISS — 

(2) Multiple x86 OSC breakpoints are enabled. Each $$ mG - 5 

breakpoint falls on a different 4 Kbyte page. FIG. 5 is a debug processing routine executed when a 

(3) Multiple x86 CISC breakpoints are enabled. Multiple page misses in the TLB. Debug page miss routine 300 is 
brealqpoints fall on the same 4 Kbyte page. called or entered from another emulation routine for pro- 

These three cases are handled separately. For the simplest cessing page misses and loading translation entries from the 

case (1), the breakpoint address is simply loaded into the 6o P a 6 e tables into the TLB. When debug breakpointing is 

single RISC breakpoint register— either DABR or IABR. In disabled, routine 300 is quickly exited, reducing the impact 

all cases a basic rule is followed — that a brealqpoint may on performance. 

have a page translation entry in the TLB only if that The first step 310 is to determine if breakpointing is 

breakpoint is loaded into the single RISC breakpoint register enabled. This can be determined by reading a global enable 

(DABR or IABR). 65 bit in emulation memory or in the condition register. Higher 

Case (2) is more complex, having multiple breakpoints performance is achieved by defining a bit in the RISC CR 

that must share a single breakpoint register. Since there is register 32 as a "debug active" bit, as described for FIG. 6. 
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Should debug be disabled, which is the normal condition for enabled and indicates that debug breakpointing is active, 
most programs, then debug routine 300 is exited (step 320), Multiple debug bit 32B is set when two or more breakpoints 
and the TLB miss routine can freely load the new page entry are enabled, regardless of where these breakpoints occur, 
into the TLB. When step 310 determines that debug is Multiple debug per page bit 32C is set when multiple 
enabled, then test 330 determines if the new or incoming 5 breakpoints fall within a single page. Thus the three debug 
page being loaded into the TLB contains a breakpoint. Test bits 33A, 33B, 33C correspond to the three cases or con- 
330 can be accomplished by successively comparing the figurations for the CISC debug breakpoint registers. Pro- 
incoming page's upper page address to each breakpoint grarnming the configuration for the emulated debug registers 
stored in emulation memory. If this incoming page does not into the CR register improves performance by as much as a 
contain a breakpoint, then again debug routine 300 may be 10 factor of thirty since the access of the on-chip CR register is 
exited, 320, and the incoming page freely loaded into the fast compared to an off- chip memory access to read the 
TLB. debug configuration in the emulation memory. 

If test 330 determined that the incoming page contained a ™ „„ .™^ T ^„ ^ 

. i i * *u * * . - j * j * i* EMULATION OF DEBUG REGISTER SETUP 
breakpoint, then test 340 is performed to determine if 

multiple breakpoints exist on the incoming page. While test 15 The CISC debug breakpoint registers are setup by moving 

340 could be accomplished by comparing the upper or page binary addresses to these registers one at a time, and by 

address of each debug register in emulation memory to the enabling these registers by setting bits in the debug control 

page address of the incoming page, mis would require up to register. When any of these debug setup instructions are 

four comparisons, and memory reads. A more efficient encountered, debug register load routine 200 is initiated to 

approach is to set a 'multiple breakpoints per page' bit in the 20 emulate the instruction. 

CR condition register when two or more breakpoints exist no. 7 is a state diagram of the debug setup sequence as 

onapage.Test340firstreads this CRbit, and then compares debug register setup mstnJ ctions are emulated. At first no 

the incoming page address to each breakpoint stored in registers m enabled, and state A is active. A binary 

emulation memory if the CR bit is set If both the CR bit is address b fast moyed mt0 one of ^ emulated CISC debug 

set and the compare reveals that the incoming page is a page " agisters by copying this binary address to the debug register 

with multiple breakpoints on it, then the incoming page is sctu m of cmulatioQ mcmory . xhi s debug register is 

broken into partial pages or portions, each portion with just enabled by ^ which sets mc enabie bit for me 

one breakpoint, step 350. emulated debug register. While in the prior art this instruc- 

The incoming breakpoint is read from the breakpoint tion would physically set a bit in the CISC debug control 

registers in emulation memory and loaded into the RISC 3 register 14 of FIG. 1, this instruction is emulated, calling the 

breakpoint register, either DABR or IABR, step 360. In step debug load routine 200 of FIG. 4. Debug load routine 200 

370, the whole or partial page is loaded into the TLB. For keeps track of how many of the four debug registers have 

partial pages, the upper and/or lower bound fields are loaded been enabled, and if any two of the breakpoints fall within 

and their compare enable bits are set, as described for FIGS. a single page. 

3 and 11. The TLB entry that contains the old or 'outgoing 1 35 State tadka 40 of mQ 7 sequeDces through four states: 

breakpoint that was in the RISC breakpoint register is A, B f Q D as debug registers are enabled or disabled, 

removed from the TLB in step 380. Step 380 can be keeping track of the number of registers enabled and if 

performed by a TLB invalidate entry instruction or multiple breakpoints are on a page. States B, C, D corre- 

procedure, such as the PowerPC™ tibie instruction, or by spond t0 me ^ ^ (2)j (3) respectively of possible 

over-writing the old TLB entry. configurations of the debug registers as described above in 

An alternative to step 310 is to test if multiple breakpoints the overview section, 

are enabled, instead of testing whether debug is enabled. If At no ^bug breaIq>oints are enabled. When the first 

only one breakpoint is enabled, then there is no need to breakpoint is enabled, the attempted execution of the debug 

execute the rest of debug routine 300, as the single RISC 45 ena blQ instruction which sets the enable bit in the debug 

debug register is already loaded with the only breakpoint control register causes debug load routine 200 to be acti- 

address, and no page management is needed for debug state tracker 40 advances from state A to state B, 

processing. The 'multiple debug breakpoints active* bit in indicating that one debug breakpoint has been enabled The 

the CR register is checked instead of the "debug active* bit acxt attempt to execute the debug enable instruction will 

in the CR register. For RISC processors with both a data 5Q q Q q^]q a second breakpoint, and state tracker 40 will usually 

operand and an instruction breakpoint register (DABR and advance from state B to state C. State C indicates that 

IABR), up to one breakpoint of each type (data and multiple breakpoints are enabled, but on different pages. A 

instruction) may be loaded without requiring debug process- test ^ performed by debug load routine 200 to deter- 

ing by the TLB miss handler. mine if the newly-enabled debug breakpoint lies on the same 

^mm^TAvr ™™ 55 page as another breakpoint. If so, then multiple breakpoints 

CONDITION CODE ^CTBR IDENTIFIES ^ on mc samc j^and state D rather than stateC will 

DEBUO SETUP be entered from state B> Alternatively, if two or more 

FIG. 6 is a diagram of the condition register CR on a RISC breakpoints have already been enabled, and the new break- 
processor with bits defined for aiding debug emulation. CR point lies in the same page as an existing breakpoint, then 
register 32 is a 32-bit register on the RISC CPU die which 60 stage D will be entered from state C. 
is implicitly accessible by many instructions. For example, Other instructions will disable existing breakpoints, also 
an add instruction may set a zero flag in CR register 32 when causing debug load routine 200 to be activated. States D, C, 
the result is zero. While many bits in CR register 32 are and B may then be exited far states C, B, or A, as indicated 
defined by the RISC arcMtecture, other bits may be freely by the dotted arrows of FIG. 7. While state tracker 40 could 
used. Of these freely-usable bits, the emulation handler 65 be implemented using flip-flops on the CPU die, it is 
defines up to three of them for use with debug emulation. preferably coded into debug load routine 200, with the 
Debug active bit 32A is set when any debug register is current state being stored in emulation memory. 
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STORAGE STRUCTURES IN EMULATION CISC breakpoint register Dl. Offset 0x0400 is the break- 

MEMORY— FIG. 8 pointpiogrammed into CISC breakpoint register DBO. while 

„„ . , . offset 0x0855 is the breakpoint programmed into CISC 

FIG. 8 shows the storage structures in Ration memory breakpoint register DB2 . 

that are maintained by debug load routine 200 and TLB rmss . JTT . . .. ... . . , , . 

routine 300. Emulation memory includes debug register 5 ^ 44a * to P»* e u .* wded mt0 ^-overlapping 

setup memory area 135 for storing information on the setup partialjpages, each partial page containing just one break- 

of the emulated CISC debug registers. The current state 41 P 0 ^ T^£?, P ^ W™ at ™ s me <P B1 > bte J k ' 

of state tracker 40 is stared as a simple 2-bit binary number P°f 84 °*0U3- The lower bound is set to the lowest offset 

in memory area 135 address on the page, 0x0000. while the upper bound is set to 

m , , ' , „ _ j , 10 the last offset address before the next breakpoint at 0x400. 

The breakpoint addresses for the four x86 CISC debug ^ ^ ^ 0J ^ comalns me fest 

registers which arebeing emulated Me stored m debug at mu3 ^ ^ lower ^ b<junds ^ tQ 
emulation tawe 42 or ir^nory area 135. Four valid uts 44 ^ te(OTR Ttae yalues would te 

programmed into the 

are set or clean* to .indicate > if each of the four debug bounds fidds m g2 in ^ ^ whcn ^ ^ ^ 

breakpoints in table 42 are enabled. Alternatively, a separate 15 is loaded ^ fte ^ 

debug control register 46 may be set up in memory area 135, SL J . ^ J ^ 

The second partial page contains the second breakpoint at 

DEBUG REGISTER LOAD ROUTINE— FIG. 9 offset 0x0400. The lower bound is set to this breakpoint's 

address, 0x0400, while the upper bound is set to the last 

FIG. 9 is a routine that emulates a debug register load offset address before the next (third) breakpoint at 0x0855. 

instruction. When an instruction is decoded that enables one 20 Thus only addresses between 0x0400 and 0x0854 will be 

of the four CISC debug breakpoint registers, debug load valid for the second partial page, and other offset addresses 

routine 200 is activated. The condition register CR is read on this page will cause a page fault when the second partial 

for the debug active, multiple debug, and multiple debugs page is loaded in the TLB, Another partial page will be 

per page bits. The debug tracker 40 is advanced to the next loaded into the TLB when the offset is outside the resident 

state in step 220, as described in FIG. 7. It may be necessary 25 second partial page. 

in step 220 to compare the page address of the incoming ^ ^ ^ contains me ttM breakpoint (DR2) 
breakpoint to the page addresses of the existing, already- at 0x0g55 The lowef ^ is te0R55 whUe me 
loaded breakpoints to determine if the incoming breakpoint ^und is ^ kst offset on ^ (from, since there are 
falls on the same page as an existing breakpoint. The CR no more ^eakpoints on this page, 

register is written in step 230 to update the debug active, *> 

multiple debug, and multiple debugs per page bit, to cor- Q ^ J> P £ 

respond tothe new state of state tracker 40. The new or ^ ^ ^ 

kcormng breakpomt ado^ is written to one of the four me s J$ partial page is loaded into the TLB. 

debug address register DB0-DB4 in the debug area 135 of LLwise for me fh* ^ 

%Z»^^ 35 locationsofmebrea^^ 



is for illustration only, and can easily be in a different order. 



cleared, step 240. 

The valid bits for the four debug address registers are 

checked, step 250, to determine if this is the first breakpoint EXAMPLE OF DEBUG LOADING— FIGS. 11 A, 

to be programmed. If so, then the breakpoint address is 11B 

^f^ C ^^ 0fatrc ^ D ^ R .°K^ R l^ 40 FIGS. 11A. 11B show an example of how the storage 

aeCPUoie,ste P 260 Omerw 1S e.meT^mustbesearcted stnjctures to ^ deb setu ^ ^135 of the emulation 

for any page entries having a pag^dress matchmg the m ^ modffied ^ registers xt loaded and 

mcormng breakpoint The PowerPC™ ^C a^cture enaMe > ^ k shows £ £^ of m ^ 

provides a TLB invalidate entry instruction (Ubie) which . fc . ^"JL^, breakpoints, so data address 

^ormt ce° ^ 2 ^ d * u 8 cmulation «"*» 42 as hexadecimal 

pe ormance. ^ addresses. Since the page size is 4 Kbytes, the lower three 

MULTIPLE BREAKPOINTS ON A PAGE— FIG. hex m offset address within a while ^ 

jq upper two hex digits arc the page number or address. These 

5-digit hex addresses are sometimes written with an under- 

When two or more breakpoints lie on the same page, the score character to emphasize the separation between the 

TLB miss routine 300 is modified to load a partial page into 55 page and offset addresses. The address 7C„G50 is equiva- 

the TLB rather than the whole page. The upper and lower lent to 7C050. having a page address of 7C and an offset 

bounds of the partial page are computed and loaded into the within the page of 050. 

bounds fields of the TLB entry for the partial page. The The debug setup area 135 of emulation memory contains 

bounds checking enable bits are also set, as described for debug tracker current state 41. CISC debug emulation table 

FIG. 3. These upper and lower bounds can be pre-computed 60 42, and valid bits 44 for these four CISC debug breakpoint 

by the debug load routine 200 and stored in the debug area registers DBO, DB1, DB2 ? DB3. A TLB entry tinder 48 is 

135 of emulation memory, or the bounds can be computed also shown to indicate if any debug breakpoints are in the 

when the page is loaded during step 370 of routine 300. TLB, and if so, what debug breakpoint and which TLB 

FIG. 10 shows partitioning of a page which contains three location. This TLB entry finder is for illustration and may 

breakpoints into partial pages. The 4-Kbyte page has offset 65 not necessarily be present in emulation memory 48. FIGS, 

addresses within the page ranging from 0x0000 to OxOFFF 11 and 12 show how the data values within these structures 

hex. At offset 0x0123 is the brealmoint programmed into change as various operations occur. 
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Initially, as shown at the top of FIQ. 11A, DABR contains 7.) The next memory reference is to address 7C_J)50. 

00000, while page addresses B8, 4F, 3A, 7C, and 04 are This is a TLB hit, since TLB entry 3 already contains page 

stored in entries 0 to 4 of TLB 16. No debug breakpoints 7C. this address, 7CL.050 matches the breakpoint address 

have yet been enabled, so debug emulation table 42 and in the single RISC breakpoint register DABR 30, so a 

valid bits 44 are all cleared to zeros. No debug breakpoints s breakpoint is signaled by the RISC CPU. This breakpoint 

are currently in the TLB. The current state 41 of the state can be quickly signaled as the RISC hardware register 

tracker 40 is state A. DABR is used to signal the breakpoint. No access of 

1. ) Hie first operation is to setup the second debug register emulation memory 135 is needed. 

DBL The breakpoint address 7C„050 is loaded into DB1 8.) Memory reference 01_100, on FIG. 12B ? is a TLB 

and this CISC emulation register is enabled by setting its to miss since page address 01 is not present in TLB 16. This 

valid bit 44. This requires two discrete x86 instructions, one page is loaded into TLB entry 2. A comparison of the 

to move the breakpoint address and the second to enable the breakpoint addresses in debug emulation table 42 reveals 

debug register. that breakpoint DB0 at address 01 121 falls within this new 

Since this is the first breakpoint to be enabled, its break- page starting at 01_000. Thus this new 'incoming* break- 
point address is copied onto the RISC CPU and loaded into 15 point address 01__121 must be written to DABR 30. The 
the single RISC breakpoint register DABR 30. The current incoming breakpoint over-writes the old 'outgoing' break- 
state 41 advances to state B, and the debug active bit in pohit 7C_050 which was in DABR 30. However, the 
condition register CR is set (not shown). Apage entry having outgoing breakpoint still has its page entry in TLB 16. While 
a breakpoint is now present in the TLB, since entry 3 of TLB a search of TLB could be performed to locate the outgoing 
16 already contains page address 7C, which matches break- 20 page entry, a TLB invalidate entry instruction, tlbie, is 
point's 7C_050 page address. executed to invalidate the old breakpoint's entry in the TLB, 

2. ) The second operation is to load and enable the first which is ^ 3 - 11108 TlB entrv 3 > which i$ for P«8 e 
debug register DB0 with breakpoint address 01_121. Valid 7C * is invalidated. The TX.B location of the new 'mcoming' 
bits 44 are updated to show both DB0 and DB1 valid, and breakpoint is TLB entry 2, for debug emulation registers 
current state 41 advances to state C, indicating that multiple 25 

debug breakpoints are enabled, but not on the same page. 9-) Memory reference 01_121 hits the TLB for page 

The page address for the new breakpoint is 01, which does address 01, which is TLB entry 2. This memory reference is 

not match any entries in the TLB. DABR 30 is not changed. to the breakpoint address in the RISC breakpoint register 

3. ) The third operation, shown on HG.11B. is to setup the DABR 30 < mus a breakpoint is signaled. Emulation 
third CISC debug register DB2. breakpoint address B8_3F8 memory is not referenced as the breakpoint is signaled by 
is loaded into the third register of debug emulation table 42 me ^ c hardware. 

and valid bits 44 are set for three valid breakpoints. Hie 10.) Memory access to address B8_14C is a TLB miss, 

current state remains at state C since all three breakpoints Since page B8 contains two breakpoints, a partial page entry 

have different page addresses — 01, 7C, and B8. The page 35 must be loaded into TLB 16. Page B8 is divided into two 

address for the new breakpoint is B8, which matches entry partial pages. Address B8_14C falls within the first partial 

0 in the TLB. Thus TLB entry 0 must be invalidated since page, and upper and lower bounds of 3F7 and 000 are loaded 

the new breakpoint is not loaded into the only RISC break- iato the bound fields 84, 82 for TLB entry 0 (boundfields are 

point register, DABR 30. not shown in FIG. 12 but are shown in FIG. 3). 

4. ) The fourth operation is to load the last (fourth) debug ^ The breakpoint falling within the partial page loaded into 
register DB3 with breakpoint B8__14C. All valid bits 44 are TLB 16 is B8_14C» stored in emulation memory in debug 
now enabled. State D is entered because both DB2 and DB3 emulation register DB3. This breakpoint address is loaded 
fall within the same page, the page starting at address into RISC breakpoint register DABR 30. The outgoing 
B8_000. However, page B8 was invalidated in TLB 16 in breakpoint's TLB entry is located using a flbie instruction 
operation 3, do no further changes to TLB 16, or DABR 30 45 which invalidates location 2 in the TLB. 

are needed. However, condition register CR is updated to set Since the memory reference, B8_14C, is to the incoming 

the multiple debugs per page bit to indicate that case (3) now breakpoint loaded into RISC breakpoint register DABR 30, 

exists. a breakpoint will be signaled by the RISC CPU once the 

5. ) The setup of the CISC debug emulation registers is debug processing routine 200 and the TLB page miss 
now completed. The single RISC breakpoint register 30 50 routines finish. While the RISC hardware quickly reports the 
contains the breakpoint for DB1, and entry 3 in the TLB as breakpoint, the software page miss and debug processing 
has the DB1 breakpoint routines are relatively slow, and thus the breakpoint will not 

be reported as quickly as when the RISC breakpoint register 

EXAMPLE OF DEBUG PROCESSING— FIGS. DABR 30 is already loaded. This type of delay should be 

12A, 12B. 12C 5J xare, since it will only occur when a jump occurs to the exact 

FIGS. 12A, 12B ? 12C show an example of how the TLB breakpoint from another page, 

and RISC breakpoint register DABR are modified as page 11.) The next memory reference to address B8_100, 

misses and hits occur. The top of FIG. 12A shows the setup shown on FIG. 12C, is a page hit to the partial page loaded 

of these storage structures after the debug setup of FIGS. by operation 10. 

11 A, 11B are completed by operation 5. 60 12.) The next memory reference to address B8_3F7 is 

6. ) The first memory reference is to address E9_000. No also a page hit to the partial page loaded by operation 10. 
entry in TLB 16 matches page E9, so a TLB miss occurs. However, address B8_3F7 is at the upper bound of the 
Page E9*s page translation entry is loaded into location 4 of partial page. 

TLB 16, which might be the least-recently-used location in 13.) The next reference is to address B8_400, just a few 

TLB 16. Since none of the breakpoints in debug emulation 65 bytes above the last reference in operation 12. This memory 

table 42 falls within page E9, no further debug processing is reference is to the same 4 Kbyte page, and would be a page 

needed. hit is debug processing were not enabled. However, this 
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reference is to the other partial page, and is a miss to the or more of the partial pages as large as possible, as was done 

partial page currently loaded into TLB location 0 for break- for the first partial page. 

point DB3. Another embodiment requires no breakpoint register at all 

A TLB invalidate entry instruction is used to locate the on the CPU, Pages containing a breakpoint are never loaded 

outgoing TLB entry at location 0, which is invalidated. The 5 i n t 0 the TLB. Only pages without breakpoints are loaded 

incoming partial page contains breakpoint DB2, which is into the TLB. All references to pages with breakpoints will 

loaded into RISC breakpoint register DABR 30. The iricora- cause a TLB miss. The TLB miss handler operates as 

ing partial page is loaded to entry location 3 in TLB 16, with described, except that breakpoint pages are not loaded into 

the upper bound field set to FFF and the lower bound field the TLB. At the point that the new partial page would 
set to 3F8, the offset of the incoming breakpoint B8_3F8. io otherwise be loaded into the TLB. the TLB miss handler 

TLB location 3 holds breakpoint DB2. must emulate the memory reference causing the page fault, 

14. ) The memory reference B8_3F8 is a page hit for or load a special one time TLB entry that will be valid for 
location 3, the partial page loaded in operation 13. This only one reference, after which it will become invalid The 
reference is to the first valid offset on the partial page, which one-time TLB entry is described in the parent patent The 
is the breakpoint for debug emulation register DB2. Thus the 15 debug load and TLB miss emulation routines described 
RISC hardware detects a match with RISC breakpoint herein may be applied to these other embodiments described 
register DABR 30 and signals the breakpoint. at length in the parent patent 

15. ) Finally memory reference B8__A00 is a page hit to A partial page that does not include the brealq>oint can 
the partial page loaded in operation 13. also be loaded into the TLB. The on-chip RISC breakpoint 

20 register is not used in this embodiment Instead, the partial 

ALTERNATE EMBODIMENTS page will fo^e a page fault when me breakpoint's address is 

Several other embodiments are contemplated by the reached. The page fault routine would then signal the 

mventors.Themventionhasbeendescribedasusingasingle breakpoint rather than the CPU's hardware. This embodi- 

RISC breakpoint register. However, the invention can easily 25 nient works particularly well when multiple breakpoints 

be adapted for two or more breakpoint registers. For occur on fte same page- 

example, PowerPC™ RISC processors may have two break- The TLB miss routine of FIG. 5 may be modified to 

point registers — DABR for data operands and IABR for reduce or eliminate the CR bits used. The CISC x86 archi- 

instructions. A simple embodiment is to load DABR when tecture has only four debug registers. Thus at most four 

the CISC breakpoint is for a data operand, but load IABR 3Q pages could contain breakpoints. The page addresses, the 20 

when the CISC breakpoint is for instructions. The four CISC upper bits of the linear addresses of the breakpoints, are 

debug breakpoints stored in the emulation memory area may stored in emulation memory. These breakpoint page 

be allocated to either IABR or DABR, depending upon the addresses are updated by debug setup routine 200 in a 

type of breakpoint programmed instruction or data operand. conventional manner. 

The state tracker, and four emulated CISC debug registers 35 On a TLB miss, test 310 can check the CR bit, or another 

can be duplicated for instruction and data breakpoints. Thus bit in the emulation memory. Test 330, which determines if 

both DABR and IABR could be simultaneously used, pos- an incoming page has a breakpoint searches through the 

sibly increasing performance. A TLB entry finder may be set four breakpoint page addresses for a match. If no match is 

up in emulation memory to aid locating TLB entries for found, then the incoming page does not contain a breakpoint 

removal or invalidation. When several TLB's exist on the ^ and may be freely loaded, step 320. If a match is found, then 

CPU, then the invention may easily be adapted by ensuring a breakpoint occurs on the incoming page. Another emula- 

that all TLB's in combination do not have more than one tion memory location is consulted to determine how many 

page containing a breakpoint breakpoints are on that page. This memory location can 

Apagesizeof 4096 bytes was described with reference to conveniently be another dimension in the debug or page 
the embodiments, but other page sizes and address sizes may 4S address table. Step 350 is activated if mare than one break- 
be easily substituted by one skilled in the art Many other point lies on the page, while step 360 is activated when only 
combinations of the embodiments disclosed are possible in one breakpoint is in the incoming page. Thus only one CR 
light of the teachings herein. bit is needed, to indicate if any debug breakpoints are 

While an embodiment with only two page offset bounds enabled, 
fields 82, 84 (FIG. 3) has been explained, it would be 50 While an embodiment with four debug breakpoints has 
obvious for one skilled in the art to employ a different been described, additional debug registers can easily be 
number of offset bounds fields or a different number of provided by those skilled in the art. While simply increasing 
encoding control bits 86, 88. For example, the encoding may the number of breakpoints in the debug emulation table is 
be changed for greater than or equal to a page offset bound useful, providing an additional level of debugging has some 
value, and still fall within the spirit of the invention. Addi- 55 particular unexpected advantages. Four debug breakpoints, 
tional control bits may also be added. A "100" encoding as described, could be used by a user program operating on 
could specify that the entire page is valid except the region a lower privilege leveL Four or eight more debug break- 
between the two offset bounds 82, 84. This is useful for points could be simultaneously in use by a higher-privilege- 
watchpoints and disabling faulty memory locations. Any level operating system or system-level debugger. This 
reference between the two bounds 82. 84 would cause a page 60 system-level debugger may be used to debug the user 
fault program which itself is using all four lower-level break- 

The page with multiple breakpoints was partitioned by points, 

setting the upper bounds to the breakpoints or the last The breakpoint may vary in size or width, as is conven- 

address on the page. Other partitioning methods may be tionally known. Thus the breakpoint may be one byte to 

used. Higher performance may be achieved by breaking the 65 about four bytes in size. The invention allows the width of 

page at intermediate boundaries such as on an aligned 1 the breakpoint to be dramatically increased beyond what is 

Kbyte boundary. Another partitioning method is to make one supported in hardware. All breakpoints would trap to the 
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debug processing routine which would check the breakpoint, 
which can be of any width. The breakpoint register on the 
CPU die would not be used, but any page containing or 
within a breakpoint would not be loaded into the TLB. 

For example, the video graphics display memory, 64 5 
Kbytes to 2 Megabytes in width, may be defined as one large 
breakpoint. Any accesses to the display region would 
encounter an emulated breakpoint. This is particularly useful 
for power management When the wide breakpoint is 
encountered, the operating system is informed that the I0 
display has been updated or accessed. The display's back- 
light could then be turned on, restoring power to the display. 
Thus some surprising, unexpected results such as power 
management are possible with the invention. The emulated 
debug breakpoints are much more flexible and useful than 
the prior-art fixed debug registers. 13 

The foregoing description of the embodiments of the 
invention has been presented for the purposes of illustration 
and description. It is not intended to be exhaustive or to limit 
the invention to the precise form disclosed. Many modifi- 
cations and variations are possible in light of the above 20 
teaching. It is intended that the scope of the invention be 
limited not by this detailed description, but rather by the 
claims appended hereto. 

We claim: 

1. A method for emulating a processor having a plurality 25 
of breakpoint register, using a processor with a single 
breakpoint register for storing just one breakpoint address 
and a translation-lookaside buffer (TLB) having a plurality 

of page entries, the breakpoints being addresses which halt 
execution of a user program when accessed, the method 30 
comprising the steps of: 
freely loading page entries into the TLB when no more 

than one breakpoint in the plurality of breakpoints is 

enabled; 

when two or more breakpoints in the plurality of break- 35 
points are enabled: 

signaling a page fault when a faulting page does not 
have a translation in the TLB; 

determining if a breakpoint in the plurality of break- 
points falls within the faulting page when the page 40 
fault is signaled, the breakpoint falling within the 
faulting page hereinafter referred to as a first break- 
point; 

loading a page entry into the TLB for the faulting page; 
loading the first breakpoint into the breakpoint register 45 
on the processor when the faulting page contains the 
first breakpoint; 
invalidating any page entries in the TLB other than the 
faulting page entry for pages containing a breakpoint 
in the plurality of breakpoints other than the first 50 
breakpoint; and 
halting execution of the user program when the user 
program accesses an address matching the breakpoint 
address in the breakpoint register on the processor, 
wherein only one breakpoint in the plurality of breakpoints 55 
has a page translation entry in the TLB, the only one 
breakpoint being loaded into the breakpoint register on the 
processor when the faulting page's entry is loaded into the 
TLB. 

2. The method of claim 1 wherein the plurality of break- 60 
points are addresses of data operands, the method further 
comprising the step of: 

comparing the breakpoint address in the breakpoint reg- 
ister on the processor to an address of a data operand 
being accessed by the user program and signaling a 65 
breakpoint and halting the user program when a match 
occurs. 



3. The method of claim 1 wherein the plurality of break- 
points are addresses of instructions, the method further 
comprising the step of: 

comparing the breakpoint address in the breakpoint reg- 
ister on the processor to an address of an instruction 
being fetched for the user program and signaling a 
breakpoint and halting the user program when a match 
occurs. 

4. The method of claim 1 further comprising the steps of: 
determining when more than one breakpoint in the plu- 
rality of breakpoints falls within the faulting page; 

dividing the faulting page into partial pages when more 
than one breakpoint falls within the faulting page, each 
partial page containing no more than one breakpoint in 
the plurality of breakpoints; and 

loading bounds fields in the TLB when loading the page 
entry for the faulting page when the faulting page 
contains more than one breakpoint, the bounds fields 
defining boundaries of the partial page within the 
faulting page, 

whereby pages may contain multiple breakpoints yet the 
multiple breakpoints share the single breakpoint register on 
the processor. 

5. The method of claim 4 wherein the step of determining 
when more than one breakpoint in the plurality of break- 
points falls within the faulting page comprises the steps of: 

reading a multiple-breakpoint bit in a condition register 
on the processor, the multiple-breakpoint bit being set 
when a second breakpoint is enabled in the plurality of 
breakpoints and the second breakpoint falls within a 
page which already contains another enabled break- 
point in the plurality of breakpoints; and 

comparing for a match an address of the faulting page to 
an address of the page containing the second breakpoint 
and indicating that more than one breakpoint falls 
within the faulting page when a match occurs and the 
multiple-breakpoint bit in the condition register is set 

6. The method of claim 5 wherein the step of comparing 
for a match signals a match when an upper portion of the 
address of the faulting page matches a page address for the 
address of the page containing the second breakpoint 

7. A system for emulating a processor having a plurality 
of breakpoint registers, wherein breakpoints are addresses 
which halt execution of a user program when accessed, the 
system comprising: 

a central processing unit (CPU) comprising: 
a breakpoint register for storing a single breakpoint 
address which halts execution of a user program 
when encountered; 
address compare means, receiving a linear address 
generated by execution of the user program and 
coupled to the breakpoint register, for comparing the 
linear address to the breakpoint address and signal- 
ing a breakpoint fault when an address match occurs; 
a translation-lookaside buffer (TLB), receiving the lin- 
ear address, the TLB comprising a plurality of page 
translation entries for pages in memory having a 
fixed number of offset addresses, each page transla- 
tion entry comprising a linear address field and a 
physical address field, the TLB outputting the physi- 
cal address field for a matching entry when a portion 
of the linear address matches the linear address field 
in the matching entry; 
a memory having a plurality of storage locations addres- 
sable by a plurality of physical addresses, the memory 
having: 
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a first portion for storing a debug table comprising a 
plurality of debug entries each for storing a break- 
point address; and 
a second portion for storing an emulation handler 
routine, the emulation handler routine including: 5 
means for copying a breakpoint address from one of 
the debug entries in the debug table to the break- 
point register on the CPU; 
invalidation means for invalidating a translation 
entry in the TLB containing a breakpoint address 10 
stored in the debug table but not stored in the 
breakpoint register on the CPU; 
wherein only one breakpoint from the debug table in 
memory has a page translation entry in the TLB, the only 
one breakpoint being loaded into the breakpoint register on 15 
the processor by the emulation handler routine. 

8. The system of claim 7 wherein the CPU further 
comprises: 

a bound field in the matching entry in the TLB. the bound 
field containing a bound for a partial page; 20 

bounds checking means, receiving the bound from the 
matching entry of the TLB, for comparing a portion of 
the linear address to the bound, signaling a page fault 
if the linear address is outside the bound for the partial 
page. 25 

9. The system of claim 8 wherein the emulation handler 
routine further comprises: 

partial page loading means for loading the bound field of 
the matching entry when the page translation entry is 3Q 
for a page containing multiple breakpoints, the page 
being divided into partial pages each containing one 
breakpoint 

10. The system of claim 7 wherein the breakpoint register 
stores a single breakpoint address for a data operand and 3J 
wherein the plurality of breakpoints are breakpoints for data 
operands. 

11. The system of claim 10 wherein the breakpoint 
register is a RISC data breakpoint register and wherein the 
plurality of breakpoints are four CISC breakpoints. ^ 

12. The system of claim 10 wherein the breakpoint 
register is a RISC data breakpoint register and wherein the 
plurality of breakpoints are eight CISC breakpoints arranged 
in two privilege levels. 

13. The system of claim 7 wherein the breakpoint register 45 
stores a single breakpoint address for an instruction and 
wherein the plurality of breakpoints are breakpoints for 
instructions. 

14. The system of claim 13 wherein the breakpoint 
register is a RISC instruction breakpoint register and 5Q 
wherein the plurality of breakpoints are four CISC break- 
points. 
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15. The system of claim 14 wherein the CPU further 
comprises: 

a data breakpoint register for storing a single data break- 
point address which halts execution of a user program 
when a data operand stored at the single data break- 
point address is accessed; 

second address compare means, receiving the linear 
address generated by execution of the user program and 
coupled to the data breakpoint register, for comparing 
the linear address to the single data breakpoint address 
and signaling a data breakpoint fault when an address 
match occurs; 

whereby instruction breakpoints are stored in the breakpoint 
register but data operand breakpoints are stored in the data 
breakpoint register. 

16. The system of claim 15 wherein the plurality of 
breakpoints include data operand breakpoints and instruc- 
tion breakpoints, and wherein the debug table includes data 
and instruction breakpoints. 

17. The system of claim 7 wherein the first portion of the 
memory further comprises a valid table for storing valid bits 
indicting which debug entries in the debug table are enabled. 

18. A method for emulating a processor having a plurality 
of breakpoint registers, using a processor with no breakpoint 
register and a translation-lookaside buffer (TLB) having a 
plurality of page entries, the breakpoints being addresses 
which halt execution of a user program when accessed, the 
method comprising the steps of: 

freely loading page entries into the TLB when no break- 
point in the plurality of breakpoints is enabled; 

when one or more breakpoints in the plurality of break- 
points are enabled: 

signaling a page fault when a faulting page does not 
have a translation in the TLB; 

determining if a breakpoint in the plurality of break- 
points falls within the faulting page when the page 
fault is signaled, the breakpoint falling within the 
faulting page hereinafter referred to as a first break- 
point; 

loading a page entry into the TLB for the faulting page 
when the faulting page contains no breakpoint; 

not loading a page entry into the TLB but emulating a 
memory access for the faulting page when the fault- 
ing page contains the first breakpoint; and 
halting execution of the user program when the user 

program accesses an address matching the breakpoint 

address, 

wherein no breakpoint in the plurality of breakpoints has a 
page translation entry in the TLB. 

***** 
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